[g0w6y]

Fixes WW-5841

Without a web.xml, the embedded Tomcat context StrutsBootServer starts defaulted to the servlet-spec COOKIE+URL session tracking modes, so a session id supplied only via ;jsessionid= in the URL (no cookie at all) was accepted and kept alive with no fresh Set-Cookie. Live-reproduced before this fix: a session established by cookie was resumed by replaying the id via the URL parameter with no Cookie header sent at all.

Restricts session tracking to COOKIE only, and the session cookie now carries SameSite=Lax. Boot is part of 7.5.0, unreleased, so this lands before anyone is exposed to it.

Verified: StrutsBootTomcatTest gains testSessionCookieHasSameSiteLax and a URL-supplied-session-id test, with a cookie-based-session control. Full boot: 52/0 failures.

[lukaszlenart]

Thanks, the change is the right one and I verified it locally: both new tests fail against main's StrutsBootServer (the URL-supplied id resumed the session, counter went to 2; no SameSite) and the whole StrutsBootTomcatTest is 16/16 green on this branch. One more effect worth stating in the ticket: on main, the first response of a Boot app already rewrites the id into every link rendered by <s:url> / <s:a> (URL=/sessionProbe.action;jsessionid=…), because Tomcat's encodeURL appends it whenever the session did not arrive by cookie and URL tracking is effective. With this branch those links are clean. That is the more visible symptom and the reason cookie-only is the right default, independent of how the id gets replayed.

Changes requested:

1. THREAT_MODEL.md §5 lists the Boot container defaults the framework owns ("A deviation from these defaults is a Struts finding"). Please add two bullets there: session tracking is cookie-only, and the session cookie carries SameSite=Lax. Without them the new defaults are not part of the contract.
2. The Secure paragraph in the Javadoc is not true for Boot — see the inline comment. Please drop the sentence; a struts.boot.* setting for the cookie attributes can be a separate ticket.
3. Comments: keep them functional and short — what the code does, not the scenario it prevents. Inline comments mark the spots. Same for the test Javadoc and the // GREEN: marker.
4. Naming: the two defaults are one decision; give them one method (inline).
5. Commit headline: please use the repo form, e.g. WW-5841 fix(boot): restrict session tracking to cookies and set SameSite=Lax.

The branch is 4 commits behind main; none touch boot/, so no rebase is needed for this review.

[g0w6y]

Addressed in bfc956e:

• THREAT_MODEL.md §5: added "session tracking is cookie-only" and "the session cookie carries SameSite=Lax" to the Boot container defaults list
• dropped the Secure claim from the Javadoc; the remaining Javadoc is two lines
• setSessionTrackingModes now lives in the same method as the cookie processor, renamed restrictSessionTracking(Context); the registry initializer is back to its original one-liner
• comments reduced to what the code does; test Javadocs are one line each and the // GREEN: lines are gone
• PR title changed to the repo form

I'll update the ticket text to drop the Secure sentence and add the <s:url>/<s:a> link effect. Full boot suite: 52/0 failures; both new tests fail against main's StrutsBootServer.